Privacy

Last updated: 2026‑05‑13

Our privacy promise

Restock is a 100% on‑device pantry and gift tracker. Your data lives on your iPhone (and, if you choose, in your own private iCloud account). Restock has no servers, no analytics, no crash‑reporting SDK, no ads, no third‑party SDKs, and no networking code beyond what Apple uses to sync iCloud on your behalf. Nothing you put into Restock is ever sent to us — because there is no "us" on the other end.

What data we collect

Restock stores only the data you enter. All of it is held in SwiftData on your device, and optionally mirrored to your private iCloud database via CloudKit.

Data type	Origin	Where it lives	Who can see it
Pantry items (name, quantity, category, notes)	You type or dictate them	SwiftData on device, optional iCloud sync	You
Photos attached to items	You take or choose them	SwiftData on device, optional iCloud sync	You
Recipes and meal plans	You create them	SwiftData on device, optional iCloud sync	You
Gift‑giver attribution	You pick from Contacts	SwiftData on device, optional iCloud sync	You
Voice transcripts	You dictate; on‑device speech recognition	SwiftData on device (as item names)	You
Notification preferences	You toggle them in Settings	UserDefaults on device	You

Restock does not collect any data on its own. There is no telemetry, no usage tracking, no identifiers, no IP logs.

System permissions we ask for

When you first use a feature that needs a system permission, iOS shows a standard prompt. You can revoke any permission at any time in Settings → Restock.

Info.plist key	iOS prompt	When	Why
`NSCameraUsageDescription`	"Restock would like to access the Camera"	First time you tap "Take photo"	To photograph items or gifts so Vision can identify them on‑device
`NSPhotoLibraryUsageDescription`	"Restock would like to access your Photos"	First time you pick an existing photo	To attach an existing photo to an item
`NSMicrophoneUsageDescription`	"Restock would like to access the Microphone"	First time you tap voice‑add	To capture your voice for on‑device transcription
`NSSpeechRecognitionUsageDescription`	"Restock would like to use Speech Recognition"	First time you tap voice‑add	To transcribe spoken item names; audio never leaves your device
`NSContactsUsageDescription`	"Restock would like to access your Contacts"	First time you tag a gift giver	To let you pick a contact to credit for a gift

Restock never requests location, calendar, reminders, health, motion, Bluetooth, local network, or any tracking permissions.

What we DON'T do

No analytics (no Firebase, no Mixpanel, no Amplitude, no Sentry, nothing).
No crash reporting via third parties — only Apple's built‑in opt‑in crash reports apply.
No advertising. No ad SDKs. No ad identifiers.
No tracking across apps or websites. NSPrivacyTracking is declared false.
No servers we control. Restock makes no network requests.
No third‑party SDKs. Apple frameworks only.
No accounts. No sign‑up. No email collected.

Apple Intelligence and on‑device AI

Restock uses Apple's on‑device intelligence stack:

Foundation Models — Apple's on‑device LLM, used for categorization, recipe suggestions, and chat. Runs entirely on the Neural Engine. Nothing is sent to Apple's servers, OpenAI, or any other provider.
Vision framework — identifies items from photos on‑device.
Core ML (via Vision) — on‑device.
Speech Recognition — configured with requiresOnDeviceRecognition = true. Audio stays on your device.

Restock does not use Private Cloud Compute, ChatGPT integration, or any cloud LLM.

iCloud sync

If you have iCloud Drive enabled and you allow Restock to use it, your pantry, recipes, photos, and gift records sync through CloudKit to your private iCloud database.

The data syncs between your devices, signed in to your Apple ID.
It is stored in your iCloud account, governed by Apple's terms and Apple's encryption.
The Restock developer cannot read your iCloud data. We have no server, no admin console, no way to query it.

You can disable sync any time in Settings → [your name] → iCloud → Apps Using iCloud.

Required Reason API declarations

Apple requires apps to declare the categories of "required reason" APIs they touch. Restock's PrivacyInfo.xcprivacy declares:

Category	Code	Why
`NSPrivacyAccessedAPICategoryFileTimestamp`	`C617.1`	SwiftData and image caches read/write file modification times within the app's sandbox
`NSPrivacyAccessedAPICategoryUserDefaults`	`CA92.1`	Storing notification toggles, theme, etc.
`NSPrivacyAccessedAPICategoryDiskSpace`	`E174.1`	Checking available space before writing photo caches
`NSPrivacyAccessedAPICategorySystemBootTime`	`35F9.1`	Indirectly accessed by Foundation/`@Observable` runtime machinery

All four categories are accessed only inside Restock's own process — never for tracking, never sent off device.

Privacy nutrition label preview

When Restock ships, the privacy section of its App Store page will read:

Data Not Collected. The developer does not collect any data from this app.

This matches NSPrivacyCollectedDataTypes being an empty array and NSPrivacyTracking being false.

Questions?

If something on this page is unclear, or you spot something that contradicts how Restock actually behaves, please open an issue on the project's repository. Privacy is a contract — if we ever change it, this document changes first.